Archive
6 November 2026
Vulnerabilities first published on this day (UTC), newest first.
216 results · Clear filters · Feed
-
Medium 6.3
In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injec…
-
Medium 6.8
In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account
-
Medium 6.7
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint
-
Medium 5.0
In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session env…
-
Medium 5.3
Session Token Remains Valid After Logout in Multi-Worker Deployments
CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one API worker process (the default). Each worker process maintains its own in-memory session cache; logout only clears the cache of the single wo…
-
Medium 5.9
undici vulnerable to cross-user information disclosure via cross-origin redirect revalidation
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not …
-
Medium 5.9
undici vulnerable to cross-origin credential disclosure via array-of-tuples headers bypassing redirect stripping
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, the redirect interceptor strips sensitive headers such as Authorization, Cookie, Proxy-Authorization, and Host when a request is redirected to a different origin,…
-
Medium 5.9
undici vulnerable to Subresource Integrity bypass via whitespace in integrity metadata
undici is an HTTP client for Node.js. In versions 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3, fetch verifies Subresource Integrity metadata by splitting the integrity string on a single space, but the SRI grammar separates metadata by ASCII whitespace, wh…
-
Medium 5.9
undici vulnerable to Denial of Service via unhandled exception in cache-interceptor response replay
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing (such as the built-in dump interceptor exceeding its maxSi…
-
Medium 6.5
undici vulnerable to cross-user cache disclosure via same-origin redirect
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final res…
-
Medium 4.3
VOD Infomaniak <= 1.5.15 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Video Importation via vodimportvideo AJAX Action
The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticat…
-
Medium 6.4
Wp Parsidate <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Block Attribute
The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calendar Gutenberg block's 'theme' attribute in versions up to, and including, 6.4. This is due to insufficient input sanitization and output escaping on the block attr…
-
Medium 5.3
Redirection for Contact Form 7 <= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via 'wpcf7-redirect' Parameter
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible …
-
Medium 4.9
YaySMTP <= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'params[searchKey]' Parameter
The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to time-based SQL Injection via the 'params[searchKey]' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied p…
-
Medium 6.5
Eventin <= 4.1.29 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'id' Parameter
The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.1.29 via the 'id' parameter. This makes it possible for authenticated atta…
-
Medium 6.4
WP User Manager <= 2.10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' User Meta
The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (REST users endpoint) -> wp_users.display_name' parameter in all versions up to, and i…
-
Medium 5.3
Vulnerability-Lookup: memory amplification through webhook payload template format specifiers
In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out of proportion to their input through a webhook notification's payload template. Each placeholder's format specifier was passed unchange…
-
Medium 6.5
Travelly <= 2.3.11 - Missing Authorization to Authenticated (Contributor+) Payment Gateway Credential Disclosure via edit_form_top Handler on Tour/Hotel Edit Screen
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.11 This is due to the plugin not properly verifying that a user is authorized to perform an actio…
-
Medium 6.4
Permalink Manager Lite <= 2.6.1 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slug' parameter in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authentica…
-
Medium 6.4
Posts Table with Search & Sort <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute
The Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possibl…
-
Medium 6.4
UsersWP <= 1.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'badge' Shortcode Attribute
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'badge' parameter in all versions up to, and including, 1.2.80 due to insufficient …
-
Medium 6.1
Reflected XSS in INFINITT ULite login error page (pre-auth)
A reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser of a victim who opens a crafted link.…
-
Medium 6.3
BigFix Mobile is affected by sensitive information disclosure
The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction. A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases the attack surface and t…
-
Medium 6.5
WordPress Redux Framework plugin <= 4.5.16 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson Redux Framework redux-framework allows Stored XSS.This issue affects Redux Framework: from n/a through 4.5.16.
-
Medium 6.3
BigFix Mobile is affected by a Cross-site scripting vulnerability
The MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it. Injected HTML can be displayed to users who view the preview, which may allow cross-site scripting (XSS) when a user interacts with the craft…
-
Medium 5.3
A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not en…
-
Medium 5.9
A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filena…
-
Medium 5.3
Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the 'debug' Parameter
The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a paymen…
-
Medium 5.3
Order Tracking < 3.6.0 - Unauthenticated Payment Confirmation Forgery via PayPal IPN Listener
The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to…
-
Medium 4.8
MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content Tag
The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbit…
-
Medium 6.2
Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus
A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesCha…
-
Medium 6.5
Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator
A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client J…
-
Medium 6.1
Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux nikon metadata tag parsing
A flaw was found in GStreamer gst-plugins-good (avidemux). In the Nikon metadata tag parser, a pointer can be dereferenced without verifying that data remains in the buffer, causing out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, …
-
Medium 6.1
Gstreamer1-plugins-good: gstreamer: integer overflow in avidemux superindex/subindex parsing leading to out-of-bounds read
A flaw was found in GStreamer gst-plugins-good (avidemux). In the superindex and subindex parsers, integer overflow can bypass bounds checks and cause out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or …
-
Medium 5.5
Gstreamer1-plugins-good: gstreamer: missing subindex entry count validation in avidemux leading to denial of service
A flaw was found in GStreamer gst-plugins-good (avidemux). In the subindex parser, missing validation of the entry count can cause excessive memory allocation and denial of service. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, o…
-
Medium 6.5
Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove un…
-
Medium 6.4
Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modi…
-
Medium 6.5
Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An att…
-
Medium 5.4
Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2
A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This…
-
Medium 6.8
Keycloak-services: keycloak-services: admin api missing audience check
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to c…